Hi, I've just been through a couple of threads on this, one from a couple of years back and one from last year. I am having the same issue with logs being dropped. Obviously to maintain the integrity of my audit trail I'd like to limit/stop this. Most of the stats are 0 (which are printed every 12hours). Here is the entire config which is exactly the same on all syslog clients: options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination net { tcp("x.x.x.x" port(xxx)); }; log { source(src); destination(messages); }; log { source(src); destination(net); }; Most of the time the dropped stats are 0 but sometimes they are 3000 or so and occasionally 20000-50000! Usually this happens on the mail server or the log server which are both heavily used machines. One of the destinations is obviously backing up, likely the tcp destination for the mail server. On the logserver I already have log_fifo_size(20000); to try to alleviate this. I would have thought this was reasonable. I don't think this increases memory consumption too much either, at least not by today's standards, the server has the nominal 1GB of Ram. Should I increase this on the server and add it to on the agents too? I think this would allow a large buffer to hopefully stop this altogether (unless of course the thing goes over the 20000 or whatever). Perhaps I should set log_fifo_size to 50000? Any recommendations or feedback on this? Thanks -- Hari Sekhon